Sudo versions affected:

CVE ID:

Details:

When sudo performs its command matching, there is a special case
for pseudo-commands in the sudoers file (currently, the only
pseudo-command is sudoedit). Unlike a regular command, pseudo-commands
do not begin with a slash ('/').
The flaw is that sudo's the matching code would only check against
the list of pseudo-commands if the user-specified command also
contained no slashes. As a result, if the user ran "sudo ./sudoedit"
the normal matching code path was followed, which uses stat(2) to
verify that the user-specified command matches the one in sudoers.
In this case, it would compare the "./sudoedit" specified by the
user with "sudoedit" from the sudoers file, resulting in a positive
match.

Impact:

Exploitation of the bug requires that the sudoers file be configured
to allow the attacker to run sudoedit. If no users have been granted
access to sudoedit there is no impact.
Successful exploitation of the bug will allow a user to run arbitrary
commands for whichever user they have permission to run sudoedit
as, typically root.

Fix:

The bug is fixed in sudo 1.7.2p4 and 1.6.9p21

Credit:

This problem was brought to my attention by Glenn Waller and neonsignal.